Privacy Policy

Controller

You can find more details in our imprint. We have not appointed a data protection officer because we are not required to (Section 38 BDSG, Art. 37 GDPR). Please send questions about data protection to lukas@brombach-technologies.de.

No account: your identifiers

Orzo has no account, no password and no sign in. So that our server still knows which requests belong together, the app creates two random values the first time it starts:

• An installation ID. It stays in the app and goes to our server with ratings, scans, chat messages and other requests, so that we can count one rating per recipe and device and enforce daily limits. It is not a device or advertising identifier and says nothing about you.
• A secret member key. The app stores it in your device's protected storage (on the iPhone, in the keychain). Our server only knows an irreversible hash of it (SHA-256) and uses it to recognise which households you belong to, even after you reinstall the app.

For each member, the server stores two further random identifiers (one is seen by the others in your households, the other we use only for purchases), the name if you enter one in the app, which household your Orzo Plus applies to, until when it runs and when you became a member.

The legal basis is Art. 6(1)(b) GDPR: without these identifiers, households, ratings and Orzo Plus do not work.

What stays on your device

Orzo stores this data only on your device. We do not receive it, except where expressly stated below. It disappears when you choose “Delete my data” under “My kitchen” in the app, or when you delete the app; in the second case only the member key remains in your iPhone's keychain.

• Your answers from the setup and your settings, such as name, diet, intolerances, what you leave out, kitchen appliances, servings and cooking level, and whether and since when you have consented to your health information being sent.
• Your conversations with Orzo. The chat history is kept only on your device.
• Saved and your own recipes that you do not share with a household.
• Photos of your finished dish. They only leave the device if you choose “Share” (then to the app of your choice) or save the picture to your Photos.
• Widgets read a copy of your data through shared storage on the same device.
• Notifications such as the reminder before the trial ends or a finished timer are scheduled by the app on your device. We do not send push messages through a server.
• Clipboard. Orzo only reads it when you tap the paste button while joining with a code, and puts links or codes into it when you copy them.

Household and sync

Everyone in Orzo has at least one household; the app creates the first one itself. So that all devices in the household see the same thing, we store on our server:

• The household: name, sticker, invitation code, who created it, who is a member and since when, with the name the person entered, and whether someone has Orzo Plus for it.
• Its contents: the pantry (which foods in what amount, where in the fridge they are, so shelves, door or crisper drawer, and the best before date if a scan has read it), the shopping lists with items and amounts, the meal plan, what was cooked, and the household's cookbook, meaning recipes that Orzo wrote for someone in the household, with the picture address and, for recipes from TikTok or Instagram, the link and the creator's name.

All members see and change this data. Anyone who knows the invitation code or link sees, before joining, the household's name and sticker, who created it and the members' names. Whoever created a household can remove members and create a new code; the old one then stops working.

If you leave a household, your membership ends immediately. What you entered stays for the others. When the last member leaves a household, we delete it with its contents. The server keeps deleted entries marked as “deleted” (without content) for 30 days, so that devices that were offline for that long also learn about it.

So that nobody guesses invitation codes or creates members in bulk, the server stores, for wrong codes, your member ID and a hash of your IP address, and when a member is created, only the hash, each with a timestamp. We do not store the IP address itself: the hash is formed with a secret key (HMAC-SHA-256), so the address cannot be worked out from it. A daily clean-up removes these entries after 24 hours.

The legal basis is Art. 6(1)(b) GDPR for the household and Art. 6(1)(f) GDPR for protection against misuse, our legitimate interest in secure operation.

Scanning your pantry: photos and barcodes

When you scan your fridge, pantry cupboard or freezer, a receipt or a dish, Orzo shrinks the photos on your device and sends them to our server without metadata such as the location where they were taken. From there they go through the service OpenRouter to the AI model Claude by Anthropic. The answer says what can be seen: for a shelf, which one it is, which foods in what amount are on it, where in the fridge and, where legible, the best before date; for a receipt, every line item, so what you bought, with amount, shop and date where legible; for a dish, what it is and what it is mainly made of. What was recognised goes into your pantry and so into the household.

We do not store the photos, including those of receipts and dishes, and we write neither them nor what was recognised into a log. For the daily limits, the server only stores your installation ID and the time of each scan and deletes both after two days. Please do not photograph people or documents along with it; a receipt can show the branch, time and payment method.

If Orzo recognises a barcode while scanning, the app only sends its number (EAN) to our server. The server asks the open product database Open Food Facts for the product; if it does not know it, Claude matches the product name. Open Food Facts only receives the number, not who asked. The server remembers the result for everyone, without any link to you; for the daily limit it stores the installation ID and time for two days.

The legal basis is Art. 6(1)(b) GDPR.

Chat with Orzo and recipes Orzo writes

What you write to Orzo in the chat goes, with the conversation so far, to our server and from there through OpenRouter to Claude. So that the answer fits your kitchen, the app also sends: your pantry and what needs using up soon, your diet, only with your consent your intolerances and what you leave out (see the next section), your kitchen appliances, how many people you cook for, today's date, your meal plan for the next two weeks, your shopping list and the recipes from the cookbook that suit you.

If you ask Orzo to write a dish (“Create with Orzo”), its name, your description and the same information about your kitchen go to Claude, which writes and checks the recipe in several passes. The recipe goes into your cookbook and, if a household is open, into the household's cookbook.

We store neither the conversation nor your description on the server and write them into no log. For the daily limits, the server stores your installation ID and the time of each message and each recipe for two days.

The server keeps the finished recipe that Orzo wrote for you for 90 days, without installation ID, without household and without your description, so without any link to you. We may revise successful recipes and add them to Orzo's public cookbook. We do not keep recipes from shared posts (TikTok, Instagram, websites). Because these recipes no longer have any link to you, they are not personal data.

Voice input. If you tap the microphone in the chat, your device's speech recognition turns what you say into text. On the iPhone this is Apple's speech recognition, directly on the device where it can; only otherwise does Apple process the recording on its servers under its own privacy policy. On Android devices it is Google's speech recognition. We do not receive recordings. The recognised text appears in the input field and only goes to our server when you send it.

The legal basis is Art. 6(1)(b) GDPR; for intolerances, see the next section.

“How do you eat?” and intolerances

Information about how you eat and what you cannot tolerate can reveal something about your health or your religion. The GDPR gives such data special protection (Art. 9). That is why we handle it sparingly:

• Asking first. Before intolerances, what you leave out or your text for “How do you eat?” leave your device, the app expressly asks you whether it may send this information to our server and to the AI models for this purpose: during setup, as soon as you enter such information, and in “My Kitchen” when you change it there. The app stores your answer with the date on your device. Under “My Kitchen” › “Health data” you can give your consent at any time or withdraw it for the future.
• Without consent everything stays on your device: the app reads your text only by itself and still hides cookbook recipes you cannot tolerate, on the device. Recipes that Orzo newly writes in the chat or from shared posts then do not know your intolerances; if one of them contains something you cannot tolerate or leave out, the app points this out.
• With consent the app still reads the common terms in your text itself on the device. Only the rest, at most 200 characters, is sent to our server. There, Claude translates it into fixed options: a diet, intolerances from a fixed list and foods you leave out. Intolerances and what you leave out also go to our server and to the AI models with chat messages, recipe requests and shared posts, so that the recipes suit you.
• We never store your text, not on the server, not in a log and not in the app; the app keeps only the result. Our server does not store intolerances or what you leave out either, and the AI providers receive them only through endpoints without data retention (see “Recipients”).

The legal basis is your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). The information and the consent are voluntary; without them, Orzo does not tailor newly written recipes to your intolerances. Withdrawal applies to the future and does not affect the lawfulness of processing before it.

Recipes from TikTok and Instagram

If you share a post from TikTok or Instagram with Orzo, your device fetches the public post itself, as a browser would; TikTok or Instagram see your device and your IP address. For Instagram, the app reads the post's public embed page: description, creator and image. For TikTok, it reads the post's page: description, creator, cover image and TikTok's automatic transcript. The app sends this, with the link and your kitchen information as with the chat, to our server. Our server asks TikTok only through its official embed interface (oEmbed) for description, creator and cover image; otherwise it fetches nothing from TikTok or Instagram.

If a TikTok post's description and transcript hold no recipe, your device loads the video in its smallest version (at most 16 MB and 10 minutes) and sends it to our server. We never load a video from Instagram. If the app can't reach an Instagram post, for example because it is private, you can paste the description or share a screenshot. Video, images and text go through OpenRouter to Google's AI model Gemini, which writes down what the post shows; Claude turns that into a recipe.

We store neither the link nor the video, description or screenshot on the server and write them into no log. The finished recipe names the link and the creator as its source and is in your cookbook and, if a household is open, in its cookbook too. For the daily limits, the server stores the installation ID and time for two days. The legal basis is Art. 6(1)(b) GDPR.

Pictures for Orzo's recipes

For recipes that Orzo writes, the app creates a picture in the background. Title, ingredients and steps go to our server; Claude (through OpenRouter) describes in a few words what the finished dish looks like. The picture is then drawn by OpenAI's image model, which our server calls directly through the service fal, not through OpenRouter. fal and OpenAI receive only the title and this description, no information about you.

We store the picture in our database under a random address that starts with the recipe's short title, together with the time and, for the daily limit, your installation ID. A daily clean-up removes the installation ID after two days; after that, the picture has no link to you. Anyone who knows the address can retrieve the picture, for example the others in your household. The picture itself contains nothing about you and stays stored because it appears in cookbooks. The legal basis is Art. 6(1)(b) GDPR.

Ratings

If you give a recipe stars, the server stores the recipe, the stars, your installation ID and the time. Everyone sees only the average and the number of ratings, never who rated. If you take back your rating or delete your data in the app, we delete it. The legal basis is Art. 6(1)(b) GDPR.

Feedback and emails to us

If you send us feedback from the app, the server stores your message, the email address for a reply (only if you give one), the app version and your installation ID (for the daily limit). We delete feedback after twelve months; earlier if you delete your data in the app or write to lukas@brombach-technologies.de.

If you email us, we process your address, your message and anything you attach in order to reply, and delete the message once your request is dealt with and no retention obligation applies.

The legal basis is Art. 6(1)(b) GDPR, otherwise Art. 6(1)(f) GDPR, our legitimate interest in replying to you and improving Orzo.

How far people get in the introduction

So that we can see at which point of the introduction and the offer after it people stop, the app reports each screen reached once to our server during the first run: its name (such as “Name” or “Prices”), the variant (which problem you chose first, or which version of the offer you see), whether it is an iPhone or an Android device, and at the end whether it was completed or closed. From this, the server only counts how often that happened per day. It stores no installation, member or purchase ID and no IP address, and nothing is stored on your device for this; the numbers cannot be traced to anyone. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in improving the introduction.

In the same way, we count it when you tap a reason for cancelling under “Manage subscription” (such as “Too expensive”): only which reason, whether iPhone or Android, and how often that happened per day, without any identifier. It does not tell us whether you actually cancel afterwards.

Purchases and Orzo Plus

You buy Orzo Plus in Apple's App Store or on Google Play. Apple or Google handle the purchase and payment; we do not receive payment data.

To check, unlock and restore purchases, we use RevenueCat as a processor. The app signs in there with your random purchase ID. RevenueCat receives this ID, the purchase data from the store (product, price, currency, times, transaction numbers), technical information such as device type, system and app version, and your IP address, from which RevenueCat derives the country. RevenueCat reports every purchase, renewal and end to our server; from this we store until when your Orzo Plus runs. The other members of your household see that Orzo Plus applies to the household and from whom. We also evaluate purchases in aggregate, for example how many subscriptions are started or cancelled. For a test, we also tell RevenueCat whether the app shows you a recap before a renewal (“on” or “off”), so that we can compare renewals in both groups.

Referrals, gifts and lending. So that a referral counts, we store the first time you paid for Orzo Plus (not the trial). If you share your referral code, we store the code with your member entry; if another household takes it, we store both member IDs, when it was taken, when that household first paid, and whether and when each of you received your free month. For the free months we ask RevenueCat to extend your subscription with the store by 30 days each (on the App Store up to three months at once) (Apple sends you an email about it); for this our server asks RevenueCat about your running subscription. The other household only learns your name in the app. If you buy Orzo Plus as a gift, our server asks RevenueCat about the purchase and stores the store's transaction number, your member ID and the gift code only as a hash; the app shows you the code itself once. When it is redeemed, we store when and for which household, and until when that household has Orzo Plus. If you lend Orzo Plus to one of your households for 14 days, we store your member ID, the household, the start and the end; the members there see that Orzo Plus is lent by you. If someone there starts a paid subscription within 60 days, it counts as your referral (as above). The legal basis is Art. 6(1)(b) GDPR.

If you answer in the introduction how you heard about Orzo, or enter a creator's code, our server checks the code (only the code is sent, without any ID), and the app passes your answer (such as “TikTok”) and the code on to RevenueCat. This lets us see in aggregate through which channels and creators subscriptions come about; a code can give you a longer trial.

The legal basis is Art. 6(1)(b) GDPR for handling purchases and Art. 6(1)(f) GDPR for the aggregate evaluation, our legitimate interest in understanding our offer.

Measuring ads (Meta and TikTok)

We advertise Orzo on Instagram, Facebook and TikTok. So that Meta and TikTok learn whether an ad brought someone to Orzo, and show the ads to people Orzo can help too, the app asks at the end of the introduction whether you allow this. On the iPhone, Apple then asks as well (whether Orzo may track you). Only if you agree, on the iPhone to both questions, do the software of Meta (Meta SDK) and of TikTok (TikTok App Events SDK) start in the app; otherwise they are built in but send nothing.

With your consent, Meta and TikTok receive: your device's advertising ID (IDFA on the iPhone, Google advertising ID on Android), on the iPhone the identifier for vendors (IDFV), your IP address, device type, system and app version, that Orzo was installed and opened, and whether you try or buy Orzo Plus (product, price, currency). Trials and purchases are reported to Meta by RevenueCat from its server; for this, the app gives RevenueCat the identifiers named above and Meta's random ID for your device. The app reports the start of a trial or a purchase to TikTok directly. What is in your pantry, what you cook and eat, your diet, your name or your household never goes to them.

Meta and TikTok also process this data for their own purposes, for example to measure and deliver ads; they are responsible for this themselves, and their privacy policies apply. The legal basis is your consent (Art. 6(1)(a) GDPR, and for access to your device § 25(1) TDDDG). You can withdraw it at any time in “My Kitchen” › “Measure ads”, and on the iPhone also in Settings under Privacy & Security › Tracking; from then on the app sends nothing more. For the collection in the app and the transfer to Meta or TikTok, we are joint controllers with the respective provider (Art. 26 GDPR); the agreement on this is part of Meta's terms (Controller Addendum) and TikTok's terms (Joint Controller Addendum). You can exercise your rights with us or with the provider. Meta and TikTok alone are responsible for everything that happens afterwards; how long they store the data is set out in their privacy policies.

Permissions on your device

Orzo only asks when you use a feature, and everything also works without:

• Camera: scanning and a photo of the finished dish.
• Photos: choosing pictures to scan and saving pictures to your Photos.
• Microphone and speech recognition: voice input in the chat, on the shopping list and in the pantry. Your device's operating system recognises the speech; only the recognised text goes to our server, where it would go anyway (in the chat).
• Notifications: cooking timers and reminders you can switch on and off in the app, such as before the trial ends, before Orzo Plus renews, before shopping or for a pantry check. They are scheduled on your device; our server sends no notifications.
• Apple Health or Health Connect: only if you switch it on under “My kitchen”. Orzo then writes the nutrients of what you cooked, or photographed as a dish and ate, into your device's health app. This happens only on your device; Orzo reads nothing there and does not send this information to our server. You can switch it off in the app and in your device settings; you delete what is already in the health app there.

You can withdraw any permission in your device's settings. If Orzo asks for a rating in the store, the system shows Apple's or Google's dialog; we do not learn whether or how you rate.

This website

When you visit orzo.food, our host Cloudflare processes technically necessary data: your IP address, the time, the page requested and your browser's identifier. This is needed to deliver the site and protect it from attacks (Art. 6(1)(f) GDPR). The website sets no cookies, uses no analytics or tracking services and loads fonts and images from its own server. The buttons to the app stores lead to Apple or Google; their privacy policies apply there.

Recipients and third countries

These services process data on our behalf:

• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: hosting of the website, our server, its database and the household sync.
• OpenRouter, Inc., USA: forwards requests to the AI models. Each request goes only to endpoints that do not use the content for training and, according to OpenRouter, do not store it at all (“Zero Data Retention”). The models are Claude by Anthropic PBC, USA (scan, receipt, dish, chat, recipes, diet, picture description), and Gemini by Google LLC, USA (posts from TikTok and Instagram). They run in the cloud of Google (Vertex AI) or Amazon Web Services, Inc., USA (Bedrock); OpenRouter chooses which operator answers a request based on availability.
• fal (Features & Labels, Inc.), USA, with the image model by OpenAI, USA, which our server calls directly at fal: pictures for recipes, without information about you.
• RevenueCat, Inc., USA: managing purchases.

Only with your consent to ad measurement (see “Measuring ads”) does data also go to Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, and to TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, as independent controllers. Both may transfer data to their group companies in the USA and other third countries.

Apple and Google are themselves responsible for the App Store and Google Play, payment and their system services. Open Food Facts only receives barcode numbers from our server, and TikTok only requests for public posts by our server; both without information about you.

For providers in the USA, we base the transfer on the EU-US Data Privacy Framework (Art. 45 GDPR) if the provider is certified under it, otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). We have concluded data processing agreements with Cloudflare, OpenRouter, fal and RevenueCat (Art. 28 GDPR).

We do not sell data, show no ads in the app and create no profiles. Meta and TikTok only learn with your consent whether one of their ads brought you to Orzo (see “Measuring ads”).

How long we keep what

Photos (including receipts and dishes), chat, recipe requests, text about your diet, intolerances, shared posts

Not at all, only for the duration of the request; the AI providers do not store them either.

Daily limits (installation ID and time)

Two days; a daily clean-up removes older entries.

Hashed IP addresses and IDs when joining and creating

24 hours, also through the daily clean-up.

Household and its contents

Until the last member leaves the household or deletes their data; deleted entries for 30 days as a marker without content.

Your member entry

Until you delete your data in the app, at the latest two years after you last opened Orzo (except while your subscription is running). The daily clean-up then deletes it like “Delete my data”.

Ratings

Until you take them back or delete your data.

Pictures for recipes

Your installation ID with them for two days. The picture itself contains nothing about you and stays stored because it appears in cookbooks.

Feedback from the app

Twelve months, or until you delete your data.

Your consent to health information

On your device, until you withdraw it, delete your data or delete the app.

Emails to us

Until your request is dealt with, if no retention obligation applies.

Purchases at RevenueCat

As long as you use purchases and statutory retention obligations apply.

Referrals

400 days after the free month (for the limit of six months a year), 180 days if no one paid, or until either of you deletes their data.

Lent Plus

400 days after it ends (for the limit of twice a year), or until you delete your data.

Gifts

Unredeemed three years, redeemed 400 days (for refunds). If you delete your data, the gift stays valid without your ID.

Our server's logs

They contain no content, not even error texts from the AI providers, only whether a request worked, status codes, duration and cost, and are not stored permanently.

Children

Orzo is meant for people aged 16 and over. We do not knowingly collect data from children. If you believe a child has sent us data, such as feedback, write to lukas@brombach-technologies.de and we will delete it.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest (Art. 21). You can withdraw consent at any time for the future. To do so, write to lukas@brombach-technologies.de.

Delete everything in the app. Under “My Kitchen” › “Delete my data” you delete everything our server can link to you: your member entry with name and purchase ID, your memberships (households where you are the only member, with their contents; in shared households the member who has been there longest takes over), your ratings, your feedback, your referrals and the daily limit entries for your installation ID; for gifts you bought, the link to you. The app then resets itself on your device, including the member key in the keychain. All that remains is data without any link to you: what you entered in shared households and the others keep using, pictures for recipes, average ratings without yours and hashed IP entries for at most 24 hours. The app does not delete purchase data at Apple, Google and RevenueCat; you cancel a running subscription in the store.

Because Orzo has no account, we often cannot link data on our server to you without the app. You can also delete individual things like this: entries in the household in the app, your membership by leaving the household, ratings by taking them back, and everything on your device by deleting the app. For a request for access, give us the ID that Orzo shows under your data in “My Kitchen”: with it we find what our server links to you. For questions about purchases, the order number from your purchase confirmation from Apple or Google helps us.

Export everything in the app. Under “My Kitchen” › “Export my data” you get everything Orzo stores on your device as a readable file (JSON): your kitchen, the households with pantry, lists, plan and cookbook, your chats and your answers from the introduction (Art. 15, Art. 20 GDPR). The app creates the file on your device; it does not go to us.

You do not have to give us any data. Without the camera or photos, however, Orzo cannot scan, and without the server, household, chat and Orzo Plus do not work. We do not make automated decisions within the meaning of Art. 22 GDPR.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Changes

If Orzo changes, we update this policy. The version published here applies.